Insecurity of position-based quantum cryptography protocols against entanglement 

attacks 
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Recently, position-based quantum cryptography has been claimed to be unconditionally secure. 
On the contrary, here we show that the existing proposals for position-based quantum cryptography 
are, in fact, insecure if entanglement is shared among two adversaries. Specifically, we demonstrate 
how the adversaries can incorporate ideas of quantum teleportation and quantum secret sharing to 
compromise the security with certainty. The common flaw to all current protocols is that the Pauli 
operators always map a codeword to a codeword (up to an irrelevant overall phase). We propose a 
modified scheme lacking this property in which the same cheating strategy used to undermine the 
previous protocols can succeed with a rate at most 85%. We conjecture that the modified protocol 
is unconditionally secure and prove this to be true when the shared quantum resource between the 
adversaries is a two- or three- level system. 

PACS numbers: 03.67.Dd, 03.67.-a 



I. INTRODUCTION 

Quantum cryptography has both power and limita- 
tions. Whereas quantum cryptography can offer uncon- 
ditional security [lj-yl in communications through quan- 
tum key distribution (QKD) di] and secure multi-party 
computations through quantum secret sharing [6|, [7|| , it 
cannot protect private information in secure two-party 
computations due to standard no-go theorems in quan- 
tum bit commitment [8|, [9( and quantum oblivious trans- 
fer [Toj . So, what is the boundary to the power of quan- 
tum cryptography? 

To answer the above question, there has been much 
research interest in the subject of quantum coin nipping. 
See, for example, ll| and references cited therein. In 



this paper, we focus on another proposed application of 
quantum cryptography. It is called position-based cryp- 
tography (PBC) [l2|]. The goal of position-based cryp- 
tography is for a prover to prove to a set of cooperating 
spatially separated verifiers that he is at (or in the small 
neighborhood of) a particular spatial location. 

Why is position-based cryptography interesting? In 
everyday life, we tend place trust on spatial locations. 
For instance, when we go to a branch of a bank to de- 
posit some money, we seldom ask a teller to show his/her 
identity to us to prove that he / she is indeed a bank em- 
ployee, rather than someone faking as one. Why? This 
is because, for instance we went to the branch yesterday 
and knew where it was and so, the fact that a person 
is today standing in a particular location in a branch of 
a bank convinces us that he/she should be trusted as a 
bank employee. 



*kero.lau@utoronto.ca 
thklo@comm.utoronto.ca 



Position-based cryptography might also be of practical 
interest in, for example, automatic road tolling in vehic- 
ular communication systems (l3| . Instead of collecting 
road tolls manually or installing many automatic collec- 
tion stations in each highway entrance and exit, it would 
be nice to use, for example, satellites to track all vehicles 
in a highway and charge them road tolls automatically, 
according to the paths taken. For such a road toll system 
to be fool-proof, it is important to ensure that a cheater 
cannot fool the verifiers of his whereabout. 

Unfortunately, in the classical world, unconditionally 
secure position-based cryptography has been proven to 
be impossible [IH, [l4| ■ The reason is that classical mes- 
sage can be cloned by cheaters perfectly who can resend a 
copy to the authorized receiver. So, both senders and re- 
ceivers cannot detect an intercept-and-broadcast attack. 

Quantum cryptography has a fundamental advantage 
over classical cryptography due to the quantum no- 
cloning theorem [15l . 1 1 61 ] . In view of the success in quan- 
tum key distribution, it is an interesting question to ask 
whether PBC can be implemented with unconditionally 
security under quantum setting. As far as we know, 
the possibility of position-based quantum cryptography 
(PBQC) was first studied by Kent under the name of 
'quantum tagging' as early as 2002. Based on the idea, 
a patent of quantum tagging system introduced by Kent 
et at was granted in 2006 [l7|. However, their results 
have not appeared in the academic literature until 2010 
[l8| . Recently, before the appearance of [Hj], two PBQC 
protocols have been independently proposed by Chan- 
dran et al. H3 (hereafter denoted as Protocol A), and 
Malaney [19|, [20( (hereafter denoted as Protocol B). Pro- 
tocol A is claimed to be unconditionally secure with a 
detailed proof of security based on complementary infor- 
mation tradeoff argument. Protocol B is also claimed to 
be unconditionally secure due to the quantum no-cloning 
theorem, but no detailed security proof has been given. 
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Contrary to the claims of unconditional security, both 
protocols are, in fact, insecure. Cheaters can make use of 
entanglement to conduct non-local operations to produce 
the same response as the honest case. Independent of our 
present work, Kent, Munro, and Spiller [Tsj have dis- 
cussed some conditions required for a secure PBQC pro- 
tocol. They address that several types of PBQC scheme 
are insecure against teleportation-based attacks. They 
outline attacks if the locations of reference stations and 
authorized receiver are collinear. Their attack applies to 
Protocols A and B for the case of one spatial dimension. 

There are two objectives in this paper. First, we show 
how existing PBQC protocols (Protocols A and B) can 
be cheated by using entangled resources, and discuss why 
the protocols are insecure. We discuss not only the case of 
one spatial dimension, but also higher dimensions. Sec- 
ond, knowing the reasons, we propose a modified proto- 
col and discuss its security. Our paper is organized as 
follows. In Section [Til we outline the procedure of both 
Protocol A and Protocol B. In the following Section UTTl 
we consider the case where the number of reference sta- 
tions N = 2. Similar to [l8| but, more explicitly and 
in a step-by-step manner, we show how the protocols 
can be cheated with certainty. In Section IIV1 we con- 
sider the cases where N > 2, which can be cheated by 
techniques of quantum secret sharing and cluster state 
quantum computation. The reason of the insecurity of 
both protocols and the loophole of the claimed security 
proof are discussed in Section [Vj In Section [VTl we give 
our modified protocol and examine its security under our 
cheating scheme. Our protocol is proved to be secure in 
Section IVIII if cheaters share entangled qubits or qutrits 
only. Finally we summarize our paper in Section IVIIII 
with brief discussions. 



II. PBQC PROTOCOLS 

Here, for simplicity, we assume that all honest parties 
have synchronized clocks and work with flat Minkowski 
space-time in special relativity. The idea of position- 
based quantum cryptography is to divide encoded quan- 
tum information into several parts (but possibly entan- 
gled) and distribute to N reference stations V\ , . . . , Vn at 
various separated locations. The divided pieces are then 
sent from different directions to an authorized receiver P, 
who is located at a pre-assumed position x p surrounding 
by a finite secure region that no cheaters can get into. 
The interval of sending is well chosen in such a way that 
xp is the unique position where the shortest traveling 
time is needed for all pieces of information to come to- 
gether. For simplicity, we hereafter assume xp locates 
at midway between reference stations (or equidistance 
position in higher dimension scenario) and the divided 
information are sent simultaneously. Measurement is im- 
mediately conducted by P on the quantum system, and 
the result is broadcasted for verification. The intuition 
is as follows. Since perfect quantum measurement (ac- 



quire complete status about quantum particle) can only 
be achieved with adequate knowledge about the system, 
such as the correct basis of quantum state, cheaters out- 
side xp ought to wait for a longer time for enough in- 
formation to conduct perfect measurement. Otherwise, 
they are only able to conduct imperfect measurements. 
Therefore, references can authenticate receiver's position 
by checking the response time and error rate of broad- 
casted measurement results. Procedures of two existing 
proposals are outlined as follows. 



A. Protocol A 

The idea of Protocol A is to send the basis of mea- 
surement and the encoded qubit separately from differ- 
ent reference stations [l4{ . Security of this protocol was 
supposed to rely on the idea that quantum system can be 
measured perfectly only if the correct measurement basis 
is obtained. Explicit procedures of Protocol A follows. 

Step 1. Station V\ encodes a message u € {0, 1} as a 
qubit | it), where |0) and |1) are +1 and —1 eigenstates 
of Pauli Z operator respectively. Inspired by the well- 
known BB84 QKD protocol, V\ encrypts the message by 
applying the transformation H q on the qubit, where H 
is the Hadamard gate, q is a random bit valued or 1. 

Step 2. Vi generates N — 2 random bits 
52, qs, . . . , <7at-1) and decide a bit qw by the relation 

q = 92 + 93 + • • • + mod 2 . (1) 

The bits q%, qa , . . . , qN are distributed to the reference 
stations V2 , ■ • ■ , Vn respectively. The encoded message u 
is also sent to other stations. We assume the communi- 
cation between reference stations are secure, for example 
QKD system is employed. 

Step 3. The reference stations V\ , . . . , Vn agree a time 
t when the PBQC scheme starts. At t = t , V\ sends 
the encoded qubit to P, while Vi sends the classical bit 
q { for i = 2, 3, . . . , N. 

Step 4- Upon receiving all information, P adds up all 
bits to obtain q. The qubit can be decrypted by apply- 
ing H q , and measured in Z basis to obtain the encoded 
message. P broadcasts the results immediately to all 
reference stations. We assume all operations of P costs 
negligible time. 

Step 5. If g's are random enough, missing any one clas- 
sical bit would cause half chance of wrong measurement 
basis. Reference stations can validate the identity of P 
by checking if the response is consistent with the encoded 
message. By checking the arrival time of the response at 
different reference stations, location of P is also verified. 



B. Protocol B 

The idea of Protocol B [li| is to encode information 
into maximally entangled states and then encrypted by 
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local transformation. Information about transformations 
are sent from different reference stations. Security of this 
protocol was supposed to rely on the fact that correct 
measurement cannot be conducted without decrypting 
all qubits, as well as the idea that local measurement 
must disturb an entangled state. Explicit procedure of 
Protocol B follows. 

Step 1. N bits of message is encoded as a N qubit 
GHZ state 

|GHZ) = -L(\ ai )\a 2 )...\a N ) 

±|l©ai)|l®oa)...|leajv)) , (2) 

where a±, . . . € {1,0}; © denotes addition with mod- 
ular 2. Each reference station picks a qubit from the 
entangled state. 

Step 2. Each qubit is encrypted by local transforma- 
tion Ui and sent to an authorized receiver P. P will store 
the entangled state in his quantum memory. 

Step 3. PBQC scheme starts at an agreed time t = to. 
Every reference stations send the classical information 
about the transformation Ui to P at the same time. 

Step 4- P immediately decrypts the state after re- 
ceiving the classical information. He then conducts a N 
qubit GHZ state measurement to decode the message, 
and announces his result at once. 

Step 5. The measurement result is probably wrong 
if someone measures the state before getting all trans- 
formation information. Hence the identity of P can be 
authenticated from the announced result. Besides, the 
location of P can be verified by the checking the total 
time spent in the whole process. 




FIG. 1: At a particular time ti, front of signals sent from 
Vi, Vi, V3 are represented by solid, dashed, short-dashed lines 
respectively. While signals reach P at t = t\ , another position 
P2 inside the triangle of three reference positions (framed by 
dotted lines) can obtain all information before t\. 



V\,V-2,Vs,P are coplanar. Four reference stations are 
necessary if their locations are constrained. 

We also note that PBQC can be performed if and only 
if there exist a polyhedron formed by positions of some 
reference stations inside which P locates. Otherwise for 
all starting time chosen by the reference stations, there 
must be places inside the polyhedron such that shorter 
or equal time is required to receive all information. The 
idea is illustrated on Fig. [TJ 



III. CHEATING IN THE N = 2 CASE 



C. Dimensionality of PBQC scheme 

In general, the reference stations lie on a one dimen- 
sional straight line for N = 2; a two dimensional plane 
for N = 3; and they distribute in the three dimensional 
space for N > 3. We comment that the dimension of 
position of P that can be verified by PBQC scheme, is 
independent of the spatial dimension of reference station 
distribution. For example, even if there are two reference 
stations and they are collinear with P, all three compo- 
nents of x p = (x p , y p , z p ) can be authenticated by PBQC 
scheme. To illustrate this idea, assume V\ and V% are ly- 
ing on the x-axis, and x p is some point in between. The 
signals are sent at time according to PBQC protocols. It 
is easy to see that any position with y 7^ or z 7^ takes 
a longer time than P to receive both information from 
V\ and V2. Thus the one dimensional PBQC actually 
confirms the three dimensional position of P, instead of 
the x-coordinate only. Similarly, if P locates at the same 
plane as three reference stations Vi, T^2, V3, the PBQC 
scheme also verifies the three dimensional position of P. 
This argument however requires the position of reference 
stations are well chosen, i.e. V%,V2,P are collinear or 



Contrary to claim(s) of unconditional security, we find 
that both Protocols A and B are, in fact, insecure. We 
first demonstrate our cheating strategy for two-reference- 
stations case (i.e. N = 2) for both protocols, and gener- 
alize it to the more- reference-stations case (i.e., N > 2) 
in the next section. In the current case, we assume Vi 
and V2 are separated by distance 2d and P locates in the 
middle of two reference stations, so that they lie on a 
one-dimensional straight line. PBQC requires P is sur- 
rounded by a finite restricted area, such as inside a big 
military base, with width 21 that no cheaters can get into 
it. We assume either qubit or classical information are 
transmitted at the speed of light c, and the time for in- 
termediate processing is negligible. If the PBQC scheme 
starts at t = 0, V\ and V2 expect to get the correct re- 
sponse at t = 2d/c. 

A successful cheating is to produce the correct response 
not slower than t — 2d/c without entering the restricted 
area. We find that two cheaters are enough to cheat the 
protocols in this case. We assume cheaters B\ and B> 2 are 
sitting at d— I and d + 1 respectively, which are both just 
outside the restricted area. The layout of our scenario is 
shown in Fig. [5] 
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FIG. 2: Spacetime diagram of the one dimensional scenario. 
Solid lines denote spacetime trajectory of information which is 
possibly quantum or classical, while double lines denote that 
of classical information only. In both Protocols A and B, all 
measurements ought to be conducted at t = (d — I) /c (shown 
as squares) in order to give correct response to reference po- 
sitions on the expected time t = 2d/c. Appropriate response 
is decided after information of another cheater is received at 
t = (d + Vj/c (shown as circles). If there is no entangled re- 
sources shared, B\ has to wait for information from V% to 
conduct perfect measurement. Trajectory of the correspond- 
ing response is represented by dot-dashed line, which shows 
the correct result cannot reach V2 before t = 2d/c. 



A. Flaw in claimed security proof 

We remark that Protocol A was once believed to be 
unconditional secure. In fact, a detailed claim of proof 
of security based on complementary information trade- 
off was given in [Tij ]. The intuition behind the claimed 
proof is that the any measurement on the encrypted qubit 
would inevitably disturb the state and hence yield wrong 
outcome with non-zero probability. 

Unfortunately, in the security proof of Protocol A [l4j , 
it was implicitly assumed that no prior entanglement is 
shared by the cheaters. Indeed, a pure state is assumed 
for the state consisting of only one cheater and one honest 
party. See, for example, in the first sentence of the last 
paragraph of p. 8 of the quant-ph version 1 [l4j |. 

We remark that such an assumption is incorrect. In 
fact, the cheaters can easily nullify the security proof by 
using shared entanglement. We note that with shared 
entangled resources, quantum teleportation can be con- 
ducted by measuring the qubit appropriately 21]. The 
main idea of our cheating scheme in the N = 2 case is 
to teleport the encrypted qubit from B\ to B 2 for mea- 
surement in the correct basis. Detailed cheating strategy 
procedure is as follows. 



FIG. 3: Circuit for teleporting an unknown qubit \ip) [2ll.l2^|. 
Measurement is denoted as squares, the measurement basis 
is represented by the character inside the squares. Us = 
X (1 " S2)/2 Z (1_S1 ' /2 is the byproduct of teleportation depend- 
ing on random measurement outcome si and S2. 

B. Cheating against Protocol A in the N — 2 case 

Step 1. Before the cheaters move to the destination, 
they come together and each pick a particle from a Bell 
state 

|*oo) = ^(100) + |11)) = i(| ++) + |--)) . (3) 

We assume their quantum memory is perfect that the 
qubits remain in coherence until measurement. 

Step 2. When the PBQC scheme starts t = 0, V% 
sends a qubit H q \u) 1 and V% sends the bit q 2 = q to P. 
At t = (d — l)/c, B\ captures the qubit and B 2 obtain the 
basis information. To avoid suspicion of P, the cheaters 
can send dummy qubit and basis information to him, 
and P's response thereafter is interfered or blocked by 
classical devices. We hereafter neglect the role of P in 
our consideration. 

Step 3. B\ immediately perform a Bell measurement 
on this two qubits in order to teleport the state to B2 , the 
circuit of his measurement is given in Fig. [3] He sends 
the measurement outcomes of the encrypted qubit, s\, 
and Bell state qubit, S2, to B2 at once. We note that 
measurement outcomes of Pauli operators are +1 or — 1. 

Step 4- At the same instance t = (d — Vj/c, the tele- 
ported qubit of B 2 becomes 

x (l-s 2 )/2 z (l- Sl )/2 Hq ^ (4) 

Consider if q — 0, B 2 has a state 

X (i- S2 )/2 Z (1- 51 )/2| U ) = (_i)«(i-«i)/»| u © (1 - S2 )/2) . 

(5) 

Since B 2 knows the basis is Z, and the state in Eq. ([5]) 
is an eigenstate of Pauli Z operator, he can conduct a 
perfect measurement with outcome (— l) u s 2 . Else if q = 
0, B 2 has a state 

iJZ(l-*2)/2 x (l- Sl )/2| n ) 

= (-l)[«®( 1 - s i)/ 2 ]( 1 -^)/ 2 i/| u ©(i- Sl )/2) . (6) 

Since B 2 knows the basis is X, and the state in Eq. © 
is an eigenstate of Pauli X operator, he can conduct a 
perfect measurement with outcome (— l) u si. 
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B 2 immediately sends the result to B\. It is re- 
minded that although the measurement outcome of B 2 
contains information about outcome of B\ our telepor- 
tation scheme does not permit superluminal communica- 
tion because B\ cannot choose the measurement result 
deterministically. 

Step 5. Then at t = (d + l)/c, both B\ and B 2 knows 
the result from each other, as well as the correct measure- 
ment basis. They can invert the value of u by multiplying 
outcome of B 2 with second outcome of B x for q = 0, or 
multiplying outcome of B 2 with first outcome of B\ for 
q = 0. B\ then sends u to V\ while B 2 sends to V 2 , 
both reference stations will receive the correct signal at 
t = 2d/c. 

The whole process consumes the same amount of time 
to produce the same correct result as there is no cheaters, 
Protocol A is therefore insecure in 1-D. 

Remark: Let us explain the intuition in Step 3 (the 
teleportation step). The teleported state received by B 2 
will be acted upon by one of the four operators, /, X, Z 
and XZ. Since the original state is an eigenstate of ei- 
ther X and Z, we note that the four resulting states are 
either orthogonal to each other or the same (up to an 
irrelevant overall phase). Therefore, B 2 with the basis 
information can simply measure the qubit in that basis 
without disturbing the state at all. Subsequently, after 
hearing the actual Bell measurement outcome by B\ , B 2 
will be able to tell what the original state is. For this 
reason, B\ and B 2 can cheat successfully with certainty. 
Therefore, Protocol A is insecure. 

Remark: Let us explain the intuition from another an- 
gle. Since the measurements by B\ and B 2 commute with 
each other, we can also interpret the result from the view- 
point where B 2 performs a measurement before B\ does. 
In this case, B 2 , with the basis information will measure 
a qubit in the correct basis. By the Einstein-Podolsky- 
Rosen effect, the qubit held by B\ will be projected to 
either the same state or the opposite state to the qubit 
sent by V\. So, the task of B\ is to perform a parity 
check of the states of the two qubits. While a general 
parity check is impossible for all bases, we note that in 
Protocol A, we consider only the two bases X and Z. 
So, in this the operator XX commutes with ZZ, 

indeed B\ can perform a parity check by simply doing a 
Bell measurement. For this reason, B\ and B 2 can cheat 
successfully with certainty. 



states |$ ab ) [H| in Eq. (0 and 



C. Cheating against Protocol B in the N = 2 case 



In the current case, 2 bits of information, ab = 
{00, 01, 10, 11}, can be encoded into one of the four Bell 
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The qubits are then encrypted by random local transfor- 
mation U\ and U 2 and sent to P. The PBQC scheme 
starts at t = when reference stations broadcast {/,*, 
and is expected to end at t = 2d/c in the honest case. 
The idea of the cheating is to first capture and store the 
qubits until decryption information. One of the cheater 
is then teleport the qubit so the other cheater possess 
two entangled qubit to do Bell measurement. Step by 
step procedure is as follows. 

Step 1. Before the process, the cheaters share a Bell 
state in Eq. ([3]) and store it in good quantum memory. 

Step 2. The cheaters break into the quantum channels 
connecting P with reference stations, they capture the 
qubits sent by V\ and V 2 in a good quantum memory to 
preserve the coherence until measurement. 

Step 3. At t = (d— l)/c, both cheaters receive the [/, 
form references, Uj is applied respectively on the qubits 
to recover the encoded state |$ a &) 

Step 4- B 2 teleports the incoming qubit to B\. We 
call the encoded state qubit captured by B\(B 2 ) as qubit 
1(2), and the Bell state qubit of Bi(B 2 ) as qubit 4(3). 
We analyze the teleportation by stabilizer formalism [23[ 
as follows. B 2 apply a CNOT gate on his qubits, the 
state is then stabilized by 



K x = {-l) a Z 1 Z 2 
Ki = Z 2 Zj,Z± 



K 2 = (-l) fc A 1 A 2 A 3 , 
K 3 = X 3 X 4 . 



(10) 



Qubits 2 is then measured in X basis and qubit 3 is mea- 
sured in Z basis. The outcomes s 2 and S3 are sent to B\ 
immediately. New set of stabilizers after the measure- 
ment is 



K' 3 = s 3 Z 3 



K' 



(-l) b s 2 X 1 A 4 , 
S2A2 . 



(11) 



Qubit 2 and 3 are obviously no longer entangled as they 
are measured. K[ and K' 2 show that qubit 1 and 4 are 
left as a Bell state \& a 'b'), where a' = a + (1 — s 3 )/2 and 
b' = 6+(l — s 2 )/2. So B\ can measure the state perfectly 
by Bell measurement, the outcomes a' and b' are sent to 
B 2 immediately. 

Step 5. At t = (d + l)/c, both cheaters obtain infor- 
mation from each others, a and b are deduced from a' , 
b' , s 2 and S3, they are sent to and eventually received by 
reference stations at t = 2d/c. Hence correct results are 
extracted by cheaters using the same time as in honest 
case, PBQC is hacked. 
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FIG. 4: Positions of reference stations, cheaters, and autho- 
rized receiver of our three station scenario are shown as black 
dots. The shaded region represents the restricted area sur- 
rounding P. Without the cheating, information flows along 
solid lines; if cheating presents, information flows along solid 
lines outside the restricted area, and follows dotted lines in 
the restricted area. As the path of Va — > P — ¥ Vi is longer 
than V2 — > B2 — > B± — > Vi, process of cheating costs shorter 
time than the honest case. 

IV. CHEATING IN N > 2 CASE 

We first consider the N = 3 case which the reference 
stations lie on the same plane, and then discuss how 
the scheme can be generalized to three dimensional cases 
with N > 3. For simplicity, we assume the three refer- 
ence stations V\ , V2 , V3 locate at vertex of an equilateral 
triangle. The receiver P sits in the center of the triangle, 
which is distance d from each references, and surrounded 
by a restricted area with radius I. We find that three 
cheaters are enough to cheat both protocol perfectly. We 
assume cheaters B\ , B2 , -B3 locate at distance I from P 
and d — I from V\ , V2 , V3 respectively. A layout of their 
position is shown as Fig. H) 

A. Cheating against Protocol A in N > 2 case 

In this protocol, V\ encrypted the encoded state in 
H q \u) and distribute 92 and q% to V2 and V3. The phys- 
ical meaning of (72 and q% are number of H gate, such 
that progressively applying H q2 H q3 is equal to H q . In 
this case, the cheaters are not going to teleport the qubit 
as there is only one qubit but two separate piece of infor- 
mation. Instead they need methods to share the rotation 
information, so quantum secret sharing scheme is em- 
ployed @, 0|- Steps of the cheating scheme is as follows. 

Step 1. Before the PBQC scheme starts, the cheaters 
construct a 3-particlc GHZ state 

-L(|000) + |111)) . (12) 

They then travel to the desired position before the PBQC 
starts at t = 0. 



TABLE I: Tables of stabilizers in different cases of qi's. K\ is 
the stabilizer of GHZ state compatible with the measurement 
basis. K" , K'2 , and K' 3 ' are stabilizers after the measurement 
according to the cheating scheme. 



92 


93 


K x 


K'2' 


KS 


K'l 








X\ X2 X3 


S2X2 


S3X3 


S2S3A1 





1 


-Y 1 X 2 Y 3 


S2X2 


s 3 Y 3 


-S2S3Y1 


1 





-YiY 2 X 3 


S2Y2 


S3X3 


-S2S3F1 


1 


1 


-XiY a Y 3 


S2Y2 


S3Y3 


-S2S3X1 



Step 2. At t = (d — l)/c, B-x and B3 gets qi and 93. 
li qi — 0, cheater Bi measures his qubit in X basis; oth- 
erwise he measures in Y basis. According to the idea of 
quantum secret sharing, if both B2 and B3 measure in 
the same basis, the GHZ qubit holding by B\ becomes an 
eigenstate of Pauli X operator, otherwise it is eigenstate 
of Y operator. As an example, let us consider the case 
q2 = and #3 = 1. It can be shown that the GHZ states 
before measurement is stabilized by 

K x = -*iX 2 y 3 , K 2 = Z t Z 2 , K 3 = Z,Z 3 . (13) 

Entanglement is broken after measurement, and the sta- 
bilizers then become single particle operators. It can 
be easily obtained that Z?i's qubit is then stabilized by 
—S2S3Y, where S2 and S3 are measurement outcomes of 
B2 and S3. Results of other combination of q's are pre- 
sented in Table [T] . 

Step 3. Immediately after the measurement, B\ applies 
a Hadamard transformation H followed by a 7r/4 gate 
S on the GHZ state qubit, in order to transform the 
eigenstates of X to that of Z, and eigenstates of Y to 
that of X, with the same eigenvalues. Now it can be 
observed that if 92 + 93 is even, B\ will have a qubit 
in Z basis, otherwise he will have a qubit in X basis. 
At the the same time t = (d — l)/c, B\ also receives the 
encoded qubit sent from V± , so he has two qubits on hand 
that are parallel or anti-parallel, i.e. the two qubits are 
simultaneous eigenstate of either Pauli X or Z operator. 
B\ performs Bell measurement and gets one of the four 
outcomes in Eq. © and ©-©. 

Step 4- The cheaters share their measurement outcome 
and basis information with others. Since the mutual dis- 
tance between B\, B2 and B3 is V3l, the cheaters can 
obtain all the information at t = (d + (V~3— 1)1) /c. From 
information of B2 and B3, the actual state of the cluster 
state qubit of B x is known from Table |TJ The outcome of 
Bell measurement can tell the parity of the two qubits of 
Bi, the state of the encoded qubit is obtained. 

Step 5. Correct result is then sent by the cheaters and 
reaches the reference stations at t = (2d + (V3 — 2)1) /c. 
When comparing to the case without cheaters that the 
whole PBQC process is expected to finish at t = 2d/c, 
our cheating scheme eventually requires fewer time to 
produce the correct result. Cheaters can simply delay for 
a while before broadcasting their final outcomes, in order 
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to match the time consumption in honest case. Hence the 
protocol is cheated. 

We note that the time is shortened because information 
takes 21 /c time to travel from Si's position to S 2 's po- 
sition in honest case, while only ^/3l /c is needed if there 
are cheaters. In general if the geometry is not an equilat- 
eral triangle, our cheating scheme may still process faster 
than the honest case, provided that P is not on the same 
straight line as any two reference stations. It is because 
honest information has to be sent from a vertex to the 
centre of triangle where P locates, and then rebroadcast 
to another vertex, while information of cheaters is trans- 
mitted along edges of the triangle. 

Our cheating scheme can be generalized to cases with 
N > 3 reference stations, we need at most N cheaters in 
each case. Before the PBQC starts, the cheaters create 
a N particle GHZ state which is stabilized by 

K x = X X X 2 ...X N , Ki = Z^xZi , (14) 

for i = 2, 3, . . . , JV; subscripts of Pauli operators are order 
of remaining qubits. Each cheater Bi picks a qubit and 
travels to a position between P and Vi. When B 2 , ■ . ■ , Bjy 
receives the basis information, they measure their qubit 
in X basis if qi — 0, or Y basis if qi = 1, and broad- 
cast the results. If even number of q'a are equal to 1, 
the qubit of B\ is in X basis, otherwise it changes to 
eigenstate of Y basis. In the former case, Y measure- 
ment must be performed in pairs. Consider qi — 1 at 
position m and n, we must be able to construct a stabi- 
lizer K[ = KxKw+xKm+2 ■ ■ ■ K n = -Xx ...Y m ...Y n ... 
which is compatible to the measurements, such that 
the qubit of B\ remains at X basis after the mea- 
surement. Otherwise there is one single Y measure- 
ment at position r, the compatible stabilizer becomes 
K[ = K Y K 2 ...K r = -Yi . . . Y r . . . , and the qubit of B x 
has changed to eigenstate of Y basis. 

Identical to the N — 3 case, Si applies an SH gate 
onto his cluster state qubit, he then obtains an eigenstate 
of X operator if q is odd or an eigenstate of Z operator if 
q is even. He then measures the cluster state qubit and 
encoded qubit sent from V\ by Bell measurement and 
broadcasts the measurement outcome. In the present 
case of N > 3, cheaters do not receive all information 
at the same time, but it is easy to check that even the 
slowest piece of information should arrive as late as in 
the honest case. Information provided by S 2 , ■ ■ ■ , B/v 
determines the actual state of GHZ state qubit of Si, 
and the measurement of B\ reveals the parity between his 
two qubits. Hence the value of encoded qubit is obtained 
and cheaters sent the results to reference stations. The 
whole process takes fewer time than or the same as the 
honest case. 



B. Cheating against Protocol B in TV > 2 case 

In this protocol, 3 bits of information is encoded as one 
of the eight tripartite GHZ-type states [l9| characterizing 



by parameters bi,b 2 , b 3 

\$ bl b 2 b 3 ) = -^=(|ai)|a 2 )|a 3 )±|l©a 1 )|l©a 2 )|l©a 3 )) , 

(15) 

where a 1 ,a 2 ,a 3 ,bi,b 2} b 3 € {0,1}; (— l) bl = ±1 is the 
phase between two superposition states; b 2 — ai©a 2 and 
63 = ai0<23. The quibits are then distributed to reference 
stations, we denote the qubit held by Vi as qubit i. Qubit 
i is encrypted by arbitrary local transformation £/,-, and 
sent to P subsequently. The PBQC scheme starts at 
t = when reference stations send information of Ui to 
P, correct response should return at t = 2d/c. We find 
that three cheaters are enough to cheat perfectly in this 
case. The idea is the same as in N — 2 case, which is 
to teleport all qubits to one cheater, so he can conduct a 
N particle GHZ-type state measurement. The cheating 
strategy is as follows. 

Step 1. Before they have travelled to desire positions, 
B 2 (Si) picks qubit 4 (5), and S 3 (Si) picks qubit 6(7), 
which qubits 4 and 5, 6 and 7 are Bell states in Eq. 

Step 2. The cheaters break into the quantum chan- 
nel connecting Vi and P and capture the encrypted 
qubits. We call the qubit captured by B\ as qubit i. 
At t = (d — I) /c, cheaters receive information of Ui and 
corresponding decryption procedure is made to obtain 
the original encoded state. 

Step 3. Immediately after the decryption, B 2 and 
S3 conducts Bell measurement for teleportation. After- 
wards, the state is stabilized by 

K[ = {-l)^s 2 s i X l X h X 7 , 

K' 2 = (-1)^4^5, K' 3 = {-l) b *s 6 Z x Z 7 , 

K' 4 = s 2 X 2 , K' 5 = S4X4 

K' 6 = s 3 X 3 , K' 7 = s 6 X 6 . (16) 

It is easy to verify from Eq. p^j) that qubits 1, 5, 7 be- 
comes a GHZ-type state \&b'a'a'): where b\ = b\ © (1 — 
s 2 s 3 )/2, b' 2 = b 2 © (1 - s 4 )/2, 2 4 = 63 © (1 - s 5 )/2. So 
Si can conduct GHZ state measurement to reveal the 
residual state exactly. Result is sent to other cheaters. 

Step 4- In our equilateral triangle case, information 
exchange among cheaters is finished at t — (d + (v3 — 
l)l)/c. The encoded message 61, b 2 , b 3 can easily be 
inferred from the measuring outcomes. Correct results 
are sent to reference stations, and the whole process can 
be finished as early as t = (2d + (V3 — 2)1) /c, which is 
even shorter than the honest case. If the three stations 
are not forming an equilateral triangle, the time required 
by cheating is longer. But the time consumption is in 
general fewer than 2d/c for any 3-station scenario, PBQC 
is hence cheated. 
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V. PRINCIPLE OF THE CHEATING SCHEMES 
A. Protocol A 

We have verified that our cheating strategy works not 
only for qubits encoded in BB84 states (eigenstates of 
X and Z operators), it also works if eigenstates of both 
Pauli X, Y, and Z can be chosen for encoding. In the 
one-dimensional case, the same cheating scheme can be 
applied as described in Section fill Bl What is the intu- 
ition here? An intuition is that the teleported state will 
be transformed by one of the four operators J, X, Z, and 
XZ. Now, if the input state is an eigenstate of either 
X, or Y or Z operator, then the output state will be 
either the same or opposite to the input state (up to an 
irrelevant overall phase). Another intuition is that a Bell 
measurement by Bi allows him to check the parity of 
operators, XX, YY and ZZ simultaneously as the three 
operators commute with each other. 

In the case of more than 3 reference stations, the orig- 
inal quantum secret sharing idea does not work, because 
we need switching between the three basis instead of 
two in Protocol A. Cheating can be achieved by clus- 
ter state quantum computation (CSQC) [24j |. Instead of 
a A^-particle GHZ state, the cheaters shares a AN — 3 
particles chain cluster state. B\ picks a qubit on the 
end of the chain, while other cheaters pick 4 consecutive 
qubits from the chain. As stated in [2J], each cheater 
can conduct general rotation by measuring three qubits 
in appropriate direction, while the last qubit is measured 
in X basis to teleport the state to next cheater. Finally, 
the cluster state qubit of B\ lies in the same basis as the 
incoming qubit, and he can conduct Bell measurement as 
before. It is noted that all cluster state qubit measure- 
ments can be conducted at the same time, sequence of 
the measurement among cheaters is unimportant. It is 
because all measurement are local operations and obvi- 
ously independent to each other. We also note that the 
quantum secret sharing and quantum teleportation men- 
tioned before are special cases of CSQC. In fact CSQC is 
a more general concept, so we will analyze our cheating 
scheme under this formalism. 

We find that two characteristics of eigenstates in X, Y, 
and Z basis leave the possibility for our cheating. Firstly, 
the conversion between them (H is the transformation 
between X states and Z states; S is the transformation 
between X states and Y states) are in the Clifford group. 
Recall in the N = 2 case, we have pulled the H gate from 
Eq. Q to the front in Eq. ([6j, and let the Pauli operators 
applying on the Z states before the gate. Since the basis 
of Pauli states are not changed by Pauli operators, the 
action of transformation gate is not altered and hence 
the teleported state is in the same basis as the original 
qubit. In N > 2 cases, we refer to the general rotation 
operation of CSQC [H, 

JV 

\i>aut) = l[U Si U i \i>m) , (17) 

i=2 



where \ip ut) is the cluster state qubit held by B\\ |-0in) 
can be treated as |0) in our case; Ui is rotation induced 
by cluster state measurement, in our case it is performed 
by Bi to conduct rotation hinted by the message of Vi\ 
U-Si = X l Z l is the by product of random measurement 
outcome of the i-th qubit. It is transparent that if U are 
all operators in the Clifford group, Eq. (|17p becomes 

|V«mt) = UU^\0) = e^U\0 or 1) , (18) 

where U is the product of all U, which is the complete 
basis information separated beforehand in this protocol; 
U Sigma is a product of Pauli operators, its form depends 
U-^i as well as commutating relation between Us i and f7,-; 
e «0 _ | z | = i 5 i s the phase generated by t/s|0), and the 
state |0) can only flip to |1) or remain unchanged upon 
U s . 

The cluster state qubit of B\ is hence parallel or anti- 
parallel to the encoded qubit, B\ can obtain information 
of the unknown qubit by checking parity of his qubits on 
hand, if such parity checking measurement exists. For 
eigenstates of Pauli operators, parity of two qubits in the 
same basis can be checked by Bell measurement, which 
is the second key point to our cheating scheme. We illus- 
trate the idea using the BB84 states and leave interested 
readers to verify the Y states. If both qubits of B\ are in 
Z basis, only |$oo) and |$oi) contains even parity states 
and odd parity states appear in |$io) and |$n) only; 
while if they are in X basis, only |$oo) an d |$io) con- 
tains even parity states and odd parity states appear in 
| $01) and I $n) only. It can be seen that even and par- 
ity states do not appear in the same Bell states, hence 
cheaters can infer the parity of qubits of B\ by the Bell 
measurement result. Furthermore, cheaters know the ex- 
act form of cluster state qubit of B\, the qubit is then 
revealed by the parity. 



B. Protocol B 

This protocol is once believed to be secure. The argu- 
ment is based on the quantum no-cloning theorem [19j . 
But it is not necessary to clone the state perfectly in or- 
der to conduct a perfect measurement distant apart. The 
problem of Protocol B is that the message is encoded in 
GHZ states, which each code is related to each other 
by single bit flip and overall phase flip only. Since the 
random byproduct of our teleportation scheme are single 
particle X and Z operators, an encoded state must be 
mapped to another code state after teleportation. As a 
result, a standard decoding procedure can read out the 
teleported state perfectly. 



VI. MODIFIED PBQC SCHEME 

In Section [V] we have discussed Protocol A is insecure 
because the qubit is encoded as eigenstates of X or Z , 
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such that the basis of state do not change upon teleporta- 
tion or cluster state manipulation. And we are able to re- 
veal the parity of two particles if they are in X or Z basis. 
Notice, however, that if one modifies a protocol to allow 
more general bases other than the X, Y and Z bases, 
then our cheating strategy does not generally work, in 
the sense that B\ may not be able to find an appropriate 
basis to measure the teleported qubits perfectly. This is 
because the byproduct of random measurement outcomes 
of teleportation may map the encoded state into a state 
that is no longer a code. In fact, our cheating scheme 
fails if references encoded the 2-bit message as the states 
{|00>, (|01) ± |10))/V^, |H)} in the one dimensional case. 
It is easy to check that the by products of teleportation 
do not necessarily map a code state to a code state. But 
if the cheaters are allowed to possess general entangled 
resources, is this protocol still secure? We do not have 
the answer right now, and leave it as an open question 
as our next goal of endeavour. 

A natural modification to Protocol A hopefully resis- 
tant to the cheating is to encode the message as ±1 eigen- 
states of h(6, 6) ■ a 



\iP) = cos-|0) +sin-e 

6 6 
\i>) = sin-|0) - cos-e 



irf>\ 



1) 



1) 



(19) 
(20) 



where < 9 < ir and < <\> < 2tt, a = Xx + Yy + Zz 
is the Pauli vector. Such a modified protocol was also 
proposed in [18j . 

In the one dimensional case, reference stations V\ and 
Vi are assumed connecting with a quantum channel, 
through which QKD can be conducted. Although only 
finite bits can be communicated through QKD, random 
9 and 4> can be generated by various methods. One ex- 
ample is to make use of the universality of quantum com- 
putation, that arbitrary qubit can be constructed by se- 
quences of Clifford operators plus a 7r/8 gate [l9|, l22l |. 
A random sequence of '0' and '1' is generated by V\ and 
sent to V2. Each '0' represents an operation of Hadamard 
gate H, while a '1' represents an operation of ir/8 gate 
T, such that the encrypted state is given by HTHTT\u), 
where u S {0, 1} is the bit to be encoded, for sequence 
'01011' [lj| . Similiarly if there are N reference stations, 
each of them are connected to V\ with QKD channels for 
communication of arbitrary rotation Ui. The encrypted 
qubit sent from V\ to P is U2 ■ ■ ■ Un\u), while reference 
stations Vi . . . Vm send information of rotation Ui. 

It is not difficult to check that our modified protocol is 
immune to our original cheating strategy demonstrated 
in Section IIIII and IIV1 In the one dimensional case, Bi 
captures the state in Eq. (|19[) sent from Vi at t = 
(d — l)/c, and teleported to B 2 immediately. Although 
B2 knows the basis from V2, it can be shown that the 
teleported state can be neither parallel nor anti-parallel 
with the original one, i.e. for s± and S2 not equal to one, 
the matrix element 



Therefore B 2 cannot find a basis to measure the qubit al- 
ways perfectly without knowing measurement outcomes 
from B\. Message of B\ arrives B2 as soon a.s t — 
(d+l) I c. Even if B2 measures the qubit immediately, cor- 
rect feedback will reach V\ no earlier than t — 2(d + l)/c 
which costs more time than expected. Security of PBQC 
is hence enforced. 

In the case of more reference stations, rotation U^s 
do not belong to the Clifford group, it precludes the en- 
crypted state to transform from Eq. ([T7|) to Eq. ([T8|) . As 
in the one dimensional case, B\ cannot perform a per- 
fect measurement until the random outcomes of cluster 
state measurement are known. But the location where 
all information can reach each other in the shortest time 
locates inside the restricted area of P, in other words the 
cheaters need time than the honest case to get the correct 
result. Security of PBQC is hence enforced. 

In practice, neither the quantum operations, quantum 
channel, nor measurements are noiseless, incorrect re- 
sponse can be given even in the honest case. The total 
error rate of practical PBQC system ought to be bounded 
below the successful cheating rate, i.e. probability of pro- 
ducing correct feedback by cheaters on time. Otherwise 
failure of cheating may be regarded as error caused by 
noise, PBQC scheme hence becomes insecure. 

We now discuss the successful cheating rate of our pro- 
tocol under various cheating schemes in the one dimen- 
sional case. First of all, we consider B\ simply measures 
the qubit and announces the result. It is equal to the 
average value of |(0|?/>)| 2 for any 9 and <f>. The success- 
ful rate is obviously 50%, as it is no different from a 
random guess. Next, we consider B\ measures the qubit 
but announces until obtaining basis information from B2 ■ 
The successful rate is 75%. It is more than a random 
guess, because for 9 < n/2, Bi's measurement outcome 
is more probably correct, while it is more probably wrong 
if 9 > tt/2. Bi can announce the inverse of his measure- 
ment outcome for 9 > tt/2 case, successful rate is then 
increased. Finally we consider our teleportation cheating 
scheme. B2 measures the teleported state in Fig. [3] by 
basis states {\ip), $)}■ Consider if the result is Af- 
ter knowing S2 and S3, the cheaters announce the more 
probably correct result, i.e. 

\v) ={^),^)|max(|(^|A( 1 -^)/ 2 Z( 1 -^)/ 2 | V )| 2 )} . 

(22) 

The average successful rate is 



| X(1 - S2 )/ 2 £(1- S1 )/2|^ ^ Qr 1 



(21) 



l + max(|(^|A|V>)| 2 ,|(Vm^)| 2 ) 
max(|(^|Z|^)| 2 ,|(^|Z|^| 2 ) 
m^(MXZ\i;)\ 2 ,mXZ\^)\ 2 )\dn , (23) 



which is about 85%. We have checked numerically that 
85% is the highest successful rate can be achieved for 
any measurement basis is used by B 2 - In the case of 
more reference stations, cluster state quantum compu- 
tation requires more measurements. So there are more 
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random byproducts and the successful rate is anticipated 
to be lower than one dimensional case. 

It is noted that Chandran et al. suggests B\ can en- 
tangle the encoded qubit with his quantum memory, and 
then sends one to Bi- Since the quantum systems are 
entangled, any measurement of B\ will leave B2 a mixed 
state. Bi has to announce a response before knowing 
measurement result of B2 , otherwise the operation time 
must exceed that allowed by PBQC scheme. But mea- 
surement outcome of B2 is probabilistic, if Bi makes a 
response according to this, there is probability that the 
response received by V\ and V2 are inconsistent. This 
kind of inconsistency reveals there must be cheaters ly- 
ing between, because noisy operation in honest case must 
not produce inconsistent results. So either B\ or B2 must 
not do any measurement, the cheaters are not benefited 
by the quantum memory. 



VII. SECURITY OF MODIFIED PROTOCOL 

So far we have demonstrated how our modified PBQC 
protocol remains secure against the teleportation-based 
cheating scheme. It is curious to know whether the proto- 
col is secure if other kinds of entangled qubits are shared 
among cheaters, and strategy other than teleportation is 
employed. 

Recalling in the one dimensional case, we first teleport 
the unknown encoded state from B\ to B2 for measure- 
ment; while in N > 2 case we use secret sharing ideas 
to send a share of the basis information to B\ through 
cluster state quantum computation, parity of the cluster 
state qubit and encoded qubit is then checked. Although 
seemingly different cheating strategy is taken in one di- 
mensional and N > 2 cases, they are actually the same in 
principle. It is because the measurements of cheaters are 
local and thus independent on each others. Time order 
of the measurement is unimportant, all cheaters conduct 
their operation immediately after receiving information 
reference stations. It is easy to see that measurement of 
cluster state by B2 in the one dimensional case actually 
uses secret sharing ideas to send a share of the basis in- 
formation to Bi, while the entanglement operation and 
X basis measurement of B\ is equivalent to some parity 
checking procedure. 

We first consider the one dimensional case. Suppose a 
general 2-qubit entangled state is shared among cheaters, 
which would become any set of states containing basis 
information after measurements of B%- If the encoded 
qubit is in Z basis, we assume w.l.o.g. that B2 makes 
an measurement to 'send' states |0) and |1) to B\, In 
general, the states B\ obtained from B2 are 

If) = ff(M)|o) + fc(M)|i) 

\l) = fc*(M)|6)-3*(M)|I) , (24) 

where g, h are functions of basis information of B 2 - Here 
we have assumed |f) and \\.) are orthogonal, successful 



rate of cheating decreases in non-orthogonal case. It is 
noted that the probability for |f) or \\) to appear equals 
to 0.5, otherwise causality is violated. After the mea- 
surement, B2 transmits classical information of basis of 
encoded qubit, basis of his measurement on the entangled 
state, and the measurement outcome to B\. 

In the Z-basis case, in order to distinguish |0) and |1) 
after obtaining information from _B 2 , B\ conducts a von 
Neumann measurement with basis 

|M X ) = a|0)|6) +j8|l>|l), |M 2 )=/?*|0)|6)-a*|l)|l) 
|M 3 ) - 7 |0)|1)+<5|1)|0), |M 4 ) = <5*|0)|1)- 7 *|1)|6) , 

(25) 

where the coefficients a, /3, 7, S characterize the measure- 
ment. The states are set as above such that every |0) 
and |1) associate with either |0) or |1). Otherwise if |Mj) 
contains terms like (|0) + |1))|1), B\ cannot reveal the 
identity of encoded qubit after communicated with B2- 

Since B\ knows nothing about the basis, he always 
conducts the same measurement in Eq. (|25[) . For general 
9 and 4>, B\ gets one of the four states 

{h/>>it>, ml), \M% ml)}- (26) 

An important observation is that the cheaters are able 
to distinguish the encoded qubit, only if every measure- 
ment state \Mj) contains components of |f) and |4_) as- 
sociated with either \ip) or only. This statement can 
be reformulated to say that each state in Eq. (f2"6"| is a 
superposition of at most two states in Eq. (|25[) . 
We expand |^)|f) as 

|V)|t> = co S ~^M)|0)|0)+cos~MM)|0)|l) (27) 

+ sin|e* fl (0,0|l>|O) + sin|e«*MM)|l>|l) ■ 

W.l.o.g. we assume it is superposition of \M\) and |M 3 ), 
imposing the relations 

«4-*H-«4"i-S- (28) 

Similarly we expand IV') li) 

WD = sin^*(0,0)|O)|O)- S in^*(0,^)|O)|l) (29) 

- cos °-e^h* (9, 4>)\ 1) |6> + cos ^e* V (Ml 1) 1 1> • 

It has to be superposition of either \M%) and \Ms) or 
IM2) and I-M4), otherwise unphysical result (V'tlV'l) 7^ 
is yielded. 

We first consider |^4) is a superposition of |M 2 ) and 
I-M4). The following relations has to be satisfied 

cotfor^f =~, cabOe-**- =~. (30) 
hp go 
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Together with Eq. (|29|) . a,8 1 g{9,4>) ought to be zero. 
This implies B 2 always sends |0) and |1) to B%, and the 
basis of B\ measurement is four untangled states, i.e. 
two single qubit measurement. It can be readily seen 
that both \ip) |0) and |i/>)|0) contain component of IM2}, 
hence the cheaters cannot distinguish and after 
communication. 

Now we consider is a superposition of \Mi) and 
IM3), imposing the relations 

9 ..j h* a 9 7 ,„ , 

tan-e - ^— = -, tan-e"^ — = 4 ■ (31 
2 g* P' 2 h* S V ' 

Together with Eq. (|29]l. we have 

which can only be satisfied for 9 = tt/2 but not for general 
9. We therefore conclude that our protocol is unbreakable 
no matter what 2-qubit state is shared among cheaters, 
and what strategy the cheaters employ. We would like 
to comment on the case of 9 = tt/2 case, it means that 
the basis for encoding are perpendicular in the Bloch's 
sphere. There are only three mutually perpendicular di- 
rections in the Bloch's sphere, which can be regarded as 
the X, Y and Z directions. It explains why our cheating 
works for and only for states encoded in eigenstates of 
Pauli X, Y, Z operators. 

In the case with N > 2 reference stations, we can prove 
by contradiction that our scheme is secure for any N- 
qubit states is shared by the cheaters and any strategy 
they take. Let the maximum mutual distance between 
reference stations is 2d, we call the two maximally sepa- 
rated reference stations V\ and V2. Assume P lies in the 
middle such that the minimum time required for PBQC 
scheme is t = 2d/c. Suppose the restricted area of P is so 
large that the N cheaters have to sit very close to each ref- 
erence stations. The minimum time required for informa- 
tion exchange among cheaters is t = 2d/c. If there exists 
a strategy to cheat successfully for any 9, <fr, and any Ui 
distributed to V{. Consider the case that U3, . . . , Un are 
identity operators, in other words the basis information is 
contained in U2 only. After measurement of S3, ... , Bn, 
the situation reduces to the one dimensional case, which 
cannot be cheated as proved above. Therefore perfectly 
successful strategy for N > 2 reference stations case does 
not exist. 

In general, the cheaters can share more complicated 
quantum resources than entangled qubits. If two qubits 
belonging to an entangled network, such as a 2D clus- 
ter state, are possessed by each cheaters, it has to be 
treated as an entangled four-level system which is not 
covered in our proof. A PBQC protocol is uncondi- 
tional secure if and only if cheating cannot succeed with 
certainty no matter what entangled resources is shared 
among cheaters, and what strategy they take. We pro- 
vide in Appendix [X] the proof that our protocol is still 
secure if entangled three-level system is shared among 



cheaters. We believe our protocol is still secure in gen- 
eral, because B2S measurement on high-level entangled 
system should produce more random outcomes, which is 
not beneficial to cheating. But we cannot prove it ana- 
lytically right now and leave it as an open question. 



VIII. SUMMARY 

We have shown how entangled resources can help 
cheating the two proposed PBQC protocols. The idea 
is to use teleportation, quantum secret sharing or CSQC 
to share part of quantum information among cheaters, 
whereby measurement can be conducted before all infor- 
mation is known. Subsequent exchange of classical in- 
formation amends the result to compensate the random 
measurement outcomes of entangled resources. 

Our cheating scheme is successful because random 
byproducts of teleportation, quantum secret sharing or 
CSQC, are Pauli operators. They do not map any code 
state out of the code space. The loophole can be fixed by 
using non-Clifford states to encode the message. Based 
on this idea, we propose a modified version of Protocol 
A which the code space spans the Bloch's sphere. Our 
protocol is proved to be secure if each cheater share en- 
tangled qubits or qutrit (such as particle composites with 
effective spin 1). The highest average successful rate of 
cheating our protocol is 75% if no entangled resource is 
used, and 85% if our cheating scheme is employed. 

After the completion and circulation of a preliminary 
version of the current paper, we have learnt of a preprint 
by Buhrman et al. [25j, which claims that, for a rather 
general class of protocols, if cheaters possess unlimited 
amount of entanglement, then all PBQC protocols are 
insecure. If their argument is correct, then it will be in- 
teresting to know whether PBQC protocols remains se- 
cure if the cheaters only share finite amount of entan- 
glement, which is more realistic, and what the minimum 
amount of entanglement is required to cheat a PBQC 
scheme perfectly. Another intriguing question is whether 
PBQC is still feasible if some secret is shared by autho- 
rized receiver and reference stations, instead of commu- 
nicating all information through public channels. Very 
recently, Kent [.26] has proposed a PBQC scheme that 
is claimed to be secure, provided that P and reference 
stations agree with a sequence of bits that cannot be ob- 
tained by cheaters. Besides, Malaney has also considered 
a protocol that entangled pairs are beforehand shared 
among P and reference stations 20] . 

Finally, we have assumed in the above consideration 
that all operations are performed extremely fast compar- 
ing to the traveling time of signals. To verify the possi- 
bility of PBQC in practice, we consider the distance be- 
tween reference stations is at the order of 100km, and the 
size of restricted area of P is order of km. A round trip of 
signals takes around 100 fis, and the presence of cheating 
will give a deviation for about 1% of time, which is /is 
scale. Consider recent experiments on optical quantum 
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computation are operating on nanosecond scales |27j, the 
assumption of fast operation is still valid. 
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where |/3, 



I 2 = 1: are selection matrices. 



Comparing Eq.s (|Aip and (|A2[) . we get 



[cos ~S« + sin ~e«*(I - S$)] = P ik S%>f kj (A3) 



aylsin-Sf-cos-e^C/-^)] = fatf - S$)f, 



kk) 1 kj ■ 

(A4) 



Summing the above two relations, and taking the scalar 
product of themselves, we have 

+ sin0)S# + (1 - sin0)(I - sf])]^ 



Appendix A: Security of shared 3-level system 



(A5) 



Here we outline the proof of security of our protocol 
if an entangled three-level system is shared among two 
cheaters in one dimensional case. This guarantee the 
security in cases involving N > 2 reference stations, of 
which the one dimensional case can always be regarded 
as a special claimed in the Section fVIII 

First of all, we investigate the properties of the en- 
tangled n-level system if the cheating is successful with 
certainty. We again assume B 2 can make a measurement 
such that B\ will receive one of n orthogonal states with 
equal probability. The choice of orthogonal states incor- 
porate information about the basis of encoded qubit. If 
the encoded qubit is an eigenstate of Z, we let B\ will 
receive a states belonging to {\4>i), . . . , \ 4> n )}- Define a 
vector = (\(pi) ■ ■ ■ \(j> n )) T , such that if the encoded 

qubit is an eigenstate of n(6, <fr) ■ a, B\ will receive an ele- 
ment of the vector T{6, cj))(\(j>)), where T(9, </>) is an n x n 
unitary matrix freely chosen by B 2 . 

Let the basis of Si's measurement operator is 
{|Mi },..., |M„)}. In order to distinguish the identity 
of encoded qubit after exchanging information with B 2 , 
each state \Mi) should not contain components of both 
|</>j)|0) and |0j)|l) for any j. Define a selection matrix 
which is an diagonal matrix with eigenvalues 1 and 
only, such that Sjj — 1 if |Mj) contains component 

of |0j)|O); while Sj^j = if |Mj) contains component of 
|(f>,)|l). The states \Ms) can be written as 



\Mi) = (^rSf^M + oaf (I - S$)l&>l 
hi' 



( A1 ) 

where \ctn\ 2 + . . . + \a in \ 2 = 1; I is the n x n identity 
matrix. Since B\ knows nothing about the basis, his 
measurement is always the same. Similar to the argu- 
ment above, if B\ is able to distinguish \ip) and after 
information exchange, \Mi) has to be 



fc,fc' } j 



+p ik {i-s ( £i)f k , j \<f> j m 



(A2) 



where we have made use of the identities S 2 = S, (I — 
S) 2 = (IS), S(I-S) = 0. For sin ^ 0, above equation 
together with normalization of \Mi) imposes 



E 



q(i) * 
V 33 ij 



i 



OLiAl 



33 > ai 3 



(A6) 



This is an important relation to restrict the kind of mea- 
surement conducted by B±. It is to say that if cheating 
is successful, the absolute square sum of coefficients as- 
sociated with |0) of any state \Mi) has to be |. 

Here we show that a complete set of states sat- 
isfying Eq. (IA6|) does not exist in the entangled 
three-level system case. Assume \M\) consists of 
{|O)|0i), |0)|(/>2), 1 1)1^3)} with non-zero contribution. 
Other \M) cannot be formed by combination with two 
|0) and one |1), otherwise the inner product with \M\) 
is non-zero, unless coefficient of one |0) is zero. We ig- 
nore this case for a while and assume other |M)'s has to 
be formed by one |0) and two |1). Consider \M 2 ) share 
two common components as |-Mi), for example it contains 
{|0) \4>x), 1 1) |02)i 1 1)| <p3)}- By completeness relation of the 
measurement states, there must be a state I-M3) contains 
|1)|</>i). But there is no state containing |l)|0i) can both 
orthogonal to \M X ), \M 2 ) and satisfy Eq. ([A%)| . So \M 2 ) 
must contain {|l)|0i), |1)|02), |O)|0a)}. Since there are 
totally six orthogonal states, at least three of them must 
share the same set of components. 

Consider \M\), I-M3), I-M5) contain the terms 
{|O)|0i),|O)|0 2 ),|l)|0 3 )}- As they have to satisfy 
Eq. (|A6|) . they can be expressed as 

\Mi) = 4= (cos0<|O)|0i) + sra0 i e i "*|O>|&) +e^|l)|0 3 )) 
V2 

Since the three states are orthogonal, we require 



cos ti; cos ( 



smf , sinwe 



(A8) 



for i =/= j. The term on the right hand side has norm 1, 
which imposes constraints on left hand side such that 

\M 3 ) = -L (cos0i|O)|0i) +sin0 ie ^|O)|0 2 ) - e Wl |l)l03)) 

(A9) 



But one cannot find (#5,^5,^5) that I-M5) is orthogonal 
to I Mi) and |M 3 ). So there does not exist three states 
sharing the same components of states. We now return 
to the case that some |Mj) contains only two |0) and one 
|1) with coefficient of one |0) is zero. As the coefficient 
is zero, it is no different to treat the component as |1), it 
will then fall into paradigm of our proof. 

We have assumed in the above argument that at least 
one state is a superposition of three components, we now 
consider all states contain only two components. We find 
the only possible choice of states is 



|Mi, 



1 



V2 



(|O)|^)±e^|l>l02» 



(AlO) 



(ms^i)± S in^-« 



\M3,i) 



F — |$ ^sin-|0i) T cos- e ^^)|0 2 ; 
1 



V2 



(|O)|^ 2 )±e^|l)|0 3 )) 



(All) 



cos-|0 2 ) ±sin-e 



i(p 2 -(j>) I 



v sin-|0 2 ) T cos- e ^-«|^,: 



\M< 



1 



^=(10)103) ±e^|l)|<M) 



(A12) 



±=\i>) (^cos^3)±sin^e^-«|^i)) 



T2 l 



Bin -1^,) ^ cos -e*^-*)^; 



or some cyclic permutation of \<f>). On the other hand, 
because we have proved |M) cannot contains three com- 
ponents, each I Mi) should be written as, 



|Mi, 2 ) 
1^3,4) 

1^5,6) 



i(|^)(fi i |^))±e^|Vi)(f 2i |^)))(Al3) 
-i=(|^)(f 2 # l ))±e^|^)(T'3 l |0 l )))(A14) 
^(|^)(T3# l ))±e Wl |^)m#,»)(A15) 



When comparing the state associated with in |Mi) 
and IM3), it is clear that the expressions in Eq. (|A10|I - 
(|A12|) and Eq. (| A13I) - (|A15|) cannot be equivalent. There- 
fore, we now can claim that B\ cannot find a measure- 
ment such that the state \tp) and \xp) after exchanging 
information with i? 2 , no matter what set of 3- level states 
is transmitted by -B 2 through the entangled resources, 
which proves security of our protocol in this case. 
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